Covert Channels Using QUIC Protocol Headers

The talk opens with background on covert channels, framing them through the prisoners problem and the Department of Defense's split between storage and timing channels. It then covers later risk measures that weigh bandwidth over time and the sensitivity of the data leaking. QUIC, the UDP-based transport beneath HTTP/3, is introduced next, and the speaker explains why its connection ID field is attractive: it is a required header with a wide allowed entropy range, so random-looking bytes there can blend in.

The middle of the talk walks through a proof of concept built as a university assignment on a Python QUIC library. Public key material and encrypted data are split into connection IDs, and short command messages such as a remote identity check are sent back and forth. The speaker compared the entropy of the carried bytes with ordinary traffic captured from real sessions, and estimated throughput at roughly 10 bytes per second, just under the old 100 bits per second threshold for high risk.

The speaker is candid about weaknesses: a parity bias from the odd-valued modulus, no authenticated key exchange, exposure to bit-flipping and man-in-the-middle attacks, and fragility when synchronization is lost. The takeaway for defenders is that a high-entropy field filled with high-entropy data is hard to spot statistically, so endpoint protection and data loss prevention controls matter. The closing advice is to build and document ideas even when they have been explored before.